v1.0.0

First release. WP Shipyard was built in September 2023 and never published; this is the finished plugin.

Added

• Switch your browser into any installed theme from Appearance → WP Shipyard. Visitors and every other user keep the live theme; the switch is a cookie, nothing in the database changes.
• Launch: make the theme you are in the live theme for everyone, with a confirmation. An ordinary switch_theme() that then clears the cookie; needs switch_themes.
• Admin bar menu: a badge with the theme you are in, Exit WP Shipyard, Customize / Edit site, and every other theme as a one-click switch (capped at 12, then More…), front and back.
• While switched, View site and Customize / Edit site buttons in the header, and a reminder on Appearance → Themes, Menus and Widgets that they show the shipyard theme.
• Themes that cannot be switched into (broken, not enabled for the site, unmet WordPress or PHP requirement) say why instead of offering the switch; the API refuses them too.
• Escape hatch: ?wp_shipyard=exit on any URL clears the switch before any theme code runs.
• Switched responses carry Cache-Control: no-store, DONOTCACHEPAGE and an X-WP-Shipyard header, so page caches and CDNs never store the shipyard theme.
• Multisite: the cookie is per site, themes must be enabled for the site.
• wp_shipyard_current filter to force or veto the theme per request; Site Health → Info section; help tab; one-time pointer notice after activation; languages/wp-shipyard.pot.
• Theme cards show Live / In the shipyard tags, block or classic, the parent theme, and filter by name when there are many.
• REST API wp-shipyard/v1 (themes, switch, exit, launch) and nonce-protected admin-post.php handlers for the same actions, so the page works without JavaScript.
• wp_shipyard() helper (current(), live()) and the wp_shipyard_capability filter.
• Self-updater from GitHub Releases via manifest.json; WP_SHIPYARD_DISABLE_UPDATER turns it off, WP_SHIPYARD_DEV_MODE relaxes SSL for local update checks.

Security

• The switch is honoured only for authenticated users with the capability (manage_options by default) and only when the cookie names an installed theme. The check reads the auth cookie directly instead of populating the current user before init.
• Child themes resolve their parent for the template option.
• Cookie is HttpOnly, Secure on HTTPS, SameSite=Lax, one year.
• No external scripts or styles; the plugin makes no outbound requests other than the update check.